My team and myself are scratching our heads over this one.
For my example, we have a laptop that went missing 3 - 4 months ago, I'm confident this device is offline and the battery on the device is depleted. I pulled up the End System events of the device from XMC -> Control -> End systems to see what it's last known location was. It shows in the system details that it last pinged off an AP at 1:00am this morning. When I look at the end-system events, it doesn't show anything other than "session detected" under the Extended State column. After reviewing the remainder of the End-System events, I was able to find a last known AP, but it was a diffrent AP than the one listed in the End System Details.
How can I dig deeper and see what these Sessions are? Are they anything? If not, how can I get rid of them in the End-System Events. This makes it really difficult to track down missing devices on our network.
